Configuring and applying connection-rate ACLs
Configuring a connection-rate ACL using source IP address criteria
To configure a connection-rate ACL using UDP/TCP criteria, see Configuring a connection-rate ACL using UDP/TCP criteria.
Syntax
ip access-list connection-rate-filter <crf-list-name>Creates a connection-rate-filter ACL and puts the CLI into the ACE context:
switch(config-crf-nacl)#If the ACL already exists, this command simply puts the CLI into the ACE context.
Syntax
< filter | ignore > ip < any | hostip-addr|ip-addr mask-length>Used in the ACE context to specify the action of the connection-rate ACE and the source IP address of the traffic that the ACE affects.
< filter | ignore >The
filteroption assigns policy filtering to traffic with source IP address (SA) matching the source address in the ACE. Theignoreoption specifies bypassing policy filtering for traffic with an SA that matches the source address in the ACE.ip < any | hostip-addr|ip-addr mask-length>Specifies the SA criteria for traffic addressed by the ACE.
anyApplies the ACEs action (
filterorignore) to traffic having any SA.hostip-addrApplies the ACEs action (
filterorignore) to traffic having the specified host SA.ip-addr mask-lengthApplies the ACEs action (
filterorignore) to traffic having an SA within the range defined by either:
<src-ip-addr/cidr-mask-bits>or
<src-ip-addr <mask>>Use this criterion for traffic received from either a subnet or a group of IP addresses. The mask can be in either dotted-decimal format or CIDR format with the number of significant bits. See Using an ACL in a connection-rate configuration example.
Configuring a connection-rate ACL using UDP/TCP criteria
To configure a connection-rate ACL using source IP address criteria, see Configuring a connection-rate ACL using source IP address criteria.
Syntax
ip access-list connection-rate-filtercrf-list-nameCreates a connection-rate-filter ACL and puts the CLI into the ACE context:
switch(config-crf-nacl)#If the ACL already exists, this command simply puts the CLI into the ACE context.
Syntax
< filter | ignore | < udp | tcp > < any >< filter | ignore | < udp | tcp > < hostip-addr> [udp/tcp-options]< filter | ignore | < udp | tcp >ip-addr mask-length[udp/tcp-options]Used in the ACE context (above) to specify the action of the connection-rate ACE (filter or ignore), and the UDP/TCP criteria and SA of the IP traffic that the ACE affects.
< filter | ignore >
filter
This option assigns a policy of filtering (dropping) IP traffic having an SA that matches the source address criteria in the ACE.
ignoreThis option specifies a policy of allowing IP traffic having an SA that matches the source address criteria in the ACE.
< udp | tcp > < any | host >ip-addr|ip-addr mask-lengthApplies the filter or ignore action to either TCP packets or UDP packets having the specified SA.
anyApplies the ACEs action (
filterorignore) to IP traffic having any SA.
host <ip-addr>Applies the ACEs action (
filterorignore) to IP traffic having the specified host SA.
ip-addr <mask-length>Applies the ACEs action (
filterorignore) to IP traffic having an SA within the range defined by either:<src-ip-addr/cidr-mask-bits>
or
<src-ip-addr <mask>>
Use this criterion for traffic received from either a subnet or a group of IP addresses. The mask can be in either dotted-decimal format or CIDR format with the number of significant bits. See Using an ACL in a connection-rate configuration example.
[udp/tcp-options]
destination-port<tcp-data>[ source-port<tcp-data>]source-port<tcp-data>[ destination-port<tcp-data>]destination-port<udp-data>[ source-port<udp-data>]source-port<udp-data>[ destination-port<udp-data>]tcp-data:
operatortcp-port-#udp-data:
operatorudp-port-#
operator < eq | gt | lt | neq | range >eq<port-nbr-or-name>"Equal To": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be equal to the specified port number.
gt<port-nbr-or-name>"Greater Than": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be greater than the specified port number.
lt<port-nbr-or-name>"Less Than": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be less than the specified port number.
neq<port-nbr-or-name>"Not Equal": To have a match with the ACE entry, the TCP or UDP source-port number in a packet must not be equal to the specified port number.
range<start-port-nbr/name><end-port-nbr/name>To have a match with the ACE entry, the TCP or UDP source-port number in a packet must be in the range
<start-port-nbr/name> <end-port-nbr/name>.
tcp-dataorudp-dataTCP or UDP Port Number or (Well-Known) Port Name:
Use the TCP or UDP port number required for the desired match. The switch also accepts certain well-known TCP or UDP port names as alternates to their corresponding port numbers:
TCP/UDP-PORT:Specify port by number.
bootpcBootstrap Protocol, client (68)
bootpsBootstrap Protocol, server (67)
dnsDomain Name Service (53)
ntpNetwork Time Protocol (123)
radiusRemote Authentication Dial-In User Service (1812)
radius-oldRemote Authentication Dial-In User Service (1645)
ripRouting Information Protocol (520)
snmpSimple Network Management Protocol (161)
snmp-trapSimple Network Management Protocol (162)
tftpTrivial File Transfer Protocol (69)
Applying connection-rate ACLs
To apply a connection-rate ACL, use the access group command described below.
![[NOTE: ]](images/note.gif) | NOTE: This command differs from the access group command for non-connection-rate ACLs. |
Syntax
[no] vlan<vid>ip access-group<crf-list-name>connection-rate-filterThis command applies a connection-rate access control list (ACL) to inbound traffic on ports in the specified VLAN that are configured for connection-rate filtering. A connection-rate ACL does not apply to ports in the VLAN that are not configured for connection-rate filtering.
The
[no]form of the command removes the connection-rate ACL assignment from the VLAN.
NOTE:
The switch allows only one connection-rate ACL assignment per VLAN. If a connection-rate ACL is already assigned to a VLAN, assigning another to the same VLAN overwrites the first ACL with the second.
A connection-rate ACL can be in addition to any standard or extended ACLs already assigned to the VLAN.
Using an ACL in a connection-rate configuration example
This example adds connection-rate ACLs to the example on Connection-rate filtering configuration in the startup-config file.
In the basic example, the administrator configured connection-rate blocking on port D2. However:
The administrator has elevated the connection-rate sensitivity to
high.The server at IP address 15.45.50.17 frequently transmits a relatively high rate of legitimate connection requests, which now triggers connection-rate blocking of the server's IP address on port D2. This causes periodic, unnecessary blocking of access to the server.
The administrator needs to maintain blocking protection from the "Company Intranet" while allowing access to the server at 15.45.50.17. Because the server is carefully maintained as a trusted device, the administrator's solution is to configure a connection-rate ACL that causes the switch to ignore (circumvent) connection-rate filtering for inbound traffic from the server, while maintaining the filtering for all other inbound traffic on port D2.
The configuration steps include:
Create the connection-rate ACL with a single entry:
Use the IP address of the desired server.
Include a CIDR notation of "32" for the ACL mask. (Which means the mask allows only traffic whose source IP address (SA) exactly matches the specified IP address.)
The ACL automatically includes the implicit
filterACE as the last entry, which means that any traffic that is not from the desired server is subject to filtering by the connection-rate policy configured on port D2.
Assigning the ACL to the VLAN through which traffic from the server enters the switch.
